etc/sshd_config.d: add basic-security.conf

Ref: 88

etc/ssh/sshd_config.d/README.md

@@ -0,0 +1,3 @@
+sshd_config should include something like
+
+Include /etc/ssh/sshd_config.d/*.conf

etc/ssh/sshd_config.d/basic-security.conf

@@ -0,0 +1,13 @@
+# RSA and Ed25519 are fine, but DSA is broken and ecdsa is suspicious
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Includes public keys in logins
+LogLevel VERBOSE
+
+# root login should probably be denied entirely, but key is better than
+# password
+PermitRootLogin prohibit-password
+
+# Passwords are bad
+PasswordAuthentication no